Australia: Privacy and Other Legislation Amendment Act 2024 including data protection authority governance received Royal Assent

On 10 December 2024, the Privacy and Other Legislation Amendment Act 2024 received Royal Assent. The Act amends the existing privacy regime, including broadening the Office of the Australian Information Commissioner's (OAIC) enforcement powers. The Act gives OAIC the ability to issue mid-tier civil penalties for breaches of privacy provisions and a low-level civil penalty for administrative breaches. In accordance with the provisions stipulated within the Act, the Privacy Commissioner would be authorised to develop an APP Code upon receiving a directive from the Minister, who is responsible for determining its scope, applicability, and necessity. Conversely, codes proposed by industry would require the Commissioner's approval. Further, the Act would task the OAIC with the development of a Children's Online Privacy Code which would apply to social media providers, relevant electronic services, designated internet services, and platforms likely accessed by children. Furthermore, the Act would empower the Privacy Commissioner to develop APP codes, conduct public inquiries, impose civil penalties, monitor compliance, issue notices, and assess privacy risks. Additionally, the Act proposes an amendment to the response framework for significant data breaches and emergencies by prescribing more specific measures, such as providing information about automated decisions in privacy policies. The Act would also introduce a statutory tort for serious invasions of privacy.